For future users, the culprit was Cisco AnyConnect WebSecurity, which proxies ALL outgoing connections and for unknown reasons blocks some selected URLs, including the eclipselink repo. Curiously it does not block other download.eclipse.org URLs, leading us to believe the problem was outside our firewall.